FreeBSD : angie-module-njs -- multiple vulnerabilities (6cf326a2-b38c-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 6cf326a2-b38c-11f1-a655-3497f65b111b advisory. The njs development team reports: Access control bypass in jsaccess when an asynchronous reque...

PT-2026-97577

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description Improper access control allows unauthorized modification of application files. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2026-97674

This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal. The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content. This vulnerability is mitigated by the fact that an attacker...

CVE-2026-93620: Missing Authorization

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

PT-2026-97454

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

PT-2026-97477

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

CVE-2026-91077: Improper Access Control

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

PT-2026-97480

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

PT-2026-97455

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

PT-2026-97473

Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a...

PT-2026-97446

Name of the Vulnerable Software and Affected Versions WSP MCP – AI Agents Connector versions prior to 2.7.1 Description Broken access control allows contributors to perform unauthorized actions within the system. Recommendations Update WSP MCP – AI Agents Connector to version 2.7.1 or later...

PT-2026-97448

Name of the Vulnerable Software and Affected Versions PayPlus Payment Gateway versions prior to 8.2.6 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 8.2.5...

CVE-2026-6718: Incorrect Default Permissions

IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files...

CVE-2026-94080: Missing Authorization

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

CVE-2026-84789: Authorization Bypass Through User-Controlled Key

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

PT-2026-97494

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An improper access control issue exists in the '/api/v2/config/' endpoint, which is protected only by the IsAuthenticated permission. This allows any authenticat...

PT-2026-97492

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-94079: Missing Authorization

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

PT-2026-97558

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.17 RabbitMQ versions prior to 4.0.22 RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.6 Description In the management plugin, the match origin/1 function within rabbit mgmt cors.erl incorrectly...

CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...